[lion@rb_bus_008] > ip firewall filter print where chain=input and action=drop
Flags: X - disabled, I - invalid, D - dynamic
0 chain=input action=drop protocol=tcp dst-port=8728
1 chain=input action=drop connection-state=invalid
2 chain=input action=drop
[lion@rb_bus_008] > ip firewall filter print where chain=input and action=drop and protocol=tcp
Flags: X - disabled, I - invalid, D - dynamic
[lion@rb_bus_008] >
When you are trying to match a string, always use quotes. Console tries to guess the type of the variable, but sometimes it is not possible and you get unexpected result.